checkout-base-test@35.9.3

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the main index.js entrypoint.

Arbitrary attacker-controlled native code execution in the consuming process user's context.

Remote binary download/DNS staging followed by detached execution.

A normal import of index.js silently requires _helpers.js, which invokes run() without user action. The loader rotates obfuscated HTTPS hosts for a platform-specific binary and falls back to DNS TXT chunk reconstruction from hard-coded domains. It writes the received bytes into a temporary executable path, applies Unix execute permission, and spawns it detached through /bin/sh or cmd.exe. A short-lived timestamp file only throttles repeat execution.

This is concrete, import-triggered staged payload execution unrelated to the advertised testing utility. The absence of an npm lifecycle hook does not mitigate the runtime compromise path.